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Employing the fundamental laws of quantum physics, Quantum Key Distribution (QKD) promises 
the unconditionally secure distribution of cryptographic keys. However, in practical realisations, a 
QKD protocol is only secure, when the quantum bit error rate introduced by an eavesdropper 
unavoidably exceeds the system error rate. This condition guarantees that an eavesdropper can- 
not disguise his presence by simply replacing the original transmission line with a less faulty one. 
Unfortunately, this condition also limits the possible distance between the communicating parties, 
Alice and Bob, to a few hundred kilometers. To overcome this problem, we design a QKD pro- 
tocol which allows Alice and Bob to distinguish system errors from eavesdropping errors. If they 
are able to identify the origin of their errors, they can detect eavesdropping even when the system 
error rate exceeds the eavesdropping error rate. To achieve this, the proposed protocol employs an 
alternative encoding of information in two-dimensional photon states. Errors manifest themselves 
as quantum bit and as index transmission errors with a distinct correlation between them in case 
of intercept-resend eavesdropping. As a result, Alice and Bob can tolerate lower eavesdropping and 
higher system error rates without compromising their privacy. 

PACS numbers: 



I. INTRODUCTION 

Based upon the fundamental laws of quantum mechan- 
ics, quantum cryptography provides a technique for shar- 
ing secret cryptographic keys with unconditional security 
[T] . The underlying idea of quantum cryptography - also 
known as quantum key distribution (QKD) - is that the 
secret bits of the cryptographic key are encoded in the 
quantum states of photons. When the encoded photons 
are transmitted from one party to another, let us call 
them Alice and Bob, an eavesdropper, Evan, cannot view 
the key without introducing a significant error rate. Mea- 
suring the bit transmission error rate by comparing some 
randomly selected test bits hence allows Alice and Bob 
to verify the security of their key transmission. Since 
the first protocol for quantum cryptography, BB84 [2], 
many variations of it have been proposed. These aim at 
increasing the eavesdropping error rate, flexibility, and 
efficiency of QKD. For example, Bennett [3] suggested in 
1992 to use two non-orthogonal two-dimensional photon 
states to distribute keys, thereby increasing the flexibility 
in the choice of states. Later on, work in [5j and [5] intro- 
duced respectively a three-state scheme and a six-state 
protocol which create more difficulties for Evan. 

The main difference between the protocol by Beige et 
al. [6] and earlier protocols lies in the encoding of infor- 
mation into quantum states. Instead of encoding a whole 
alphabet into each basis, Ref. |5] proposes a scheme where 
all the vectors of the same basis encode the same letter. 
When optimising this strategy, a direct quantum com- 
munication protocol between Alice and Bob is obtained 
[7] . This protocol is a QKD protocol with maximum effi- 
ciency but a relatively low error rate in case of eavesdrop- 
ping. Recently, Khan et al. [8] used the same encoding to 
maximise intercept-resend eavesdropping error rates. In 



the following we refer to this protocol as KMB09. When 
using two-dimensional photon states, KMB09 is essen- 
tially the same as the SARG04 protocol by Scarani et 
al. 9; with X — l/\/2 13J. Brierley [TU] increased the 
eavesdropping error rate of these protocols even further 
by allowing Alice and Bob to use multiple bases of more 
than two-dimensional photon states. This improvement 
comes at the cost of very low key bit transmission effi- 
ciencies. 

In this paper, we design a QKD protocol with two- 
dimensional photon states which is characterised not only 
by one but two different types of errors with a distinct 
correlation between both of them in case of eavesdrop- 
ping. More concretely, we propose a QKD protocol, 
where Alice and Bob can calculate a Quantum Bit Error 
Rate (QBER). In addition, they can exchange informa- 
tion about the index of the transmitted state. Unex- 
pected differences in the index are measured by the In- 
dex Transmission Error Rate (ITER). This combination 
of measures makes it much harder for Evan to escape 
his detection. The eavesdropper not only has to min- 
imise different types of errors. Distinct correlations be- 
tween the ITER and the QBER, ie. a distinct signature of 
eavesdropping, allows Alice and Bob to detect the origin 
of their errors. As a result, Alice and Bob can tolerate 
lower eavesdropping and higher system error rates with- 
out compromising their privacy. We no longer require 
that the error rates in case of eavesdropping unavoidably 
exceed the system error rate, since Evan can no longer 
disguise his presence as system errors. This should allow 
Alice and Bob to communicate securely over much longer 
distances. 

The remainder of this paper is structured as follows. 
Section |ll] analyses the KMB09 protocol ^ and derives 
the error rates and key bit transmission efficiencies of 
this protocol for the case, where Alice and Bob use two- 
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dimensional photon states. Although this has not been 
emphasized in our earlier work, the KMB09 protocol is 
a QKD protocol with a QBER and an ITER. However, 
as we shall see below, there is no distinct correlation be- 
tween these errors in case of eavesdropping. Section III 
therefore presents a variation of the KMB09 protocol 
which permits Alice and Bob to use not only two but 
three different bases. The third basis increases the flex- 
ibility of the proposed protocol which can be used to 
create a linear dependence between the ITER and the 
QBER in the case of intercept-resend eavesdropping. Our 
calculations are illustrated by figures which take all pos- 
sible measurement bases of Evan into account and show 
typical values for actual realisations of the proposed pro- 
tocol. We finally summarise our findings in Section |IV| 



II. THE KMB09 PROTOCOL 

Our first step in designing a QKD protocol with the 
above described features is to notice that the encoding 
of information used in the KMB09 protocol already re- 
sults in two different types of errors: a QBER and an 
ITER. In our earlier work [8], we did not recognise the 
potential advantage of this fact and considered only the 
ITER when designing optimal QKD protocols based on 
more-than-two dimensional photon states. In this section 
we analyse the KMB09 protocol with two-dimensional 
photon states in much more detail than previously done 
and present analytical results for the QBER, the ITER, 
and the key bit transmission efficiencies with and without 
eavesdropping and introduce the notation used through- 
out this paper. As we shall see below, in the KMB09 
protocol, there are only very weak correlations between 
the QBER and the ITER. The second step in designing a 
QKD protocol with an improved eavesdropping detection 
is therefore the introduction of a variation of the original 
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TABLE I: Bob's interpretation of the measurements which 
he performs on the incoming photons, after Alice announced 
the index of the transmitted state. No key bit is obtained 
when both have the same index, as indicated by the crosses. 
An error occurs when both their states have a different index 
although both use the same bases. 



transmitted. Under ideal conditions, it is not possible 
that Alice and Bob have different indices, when both use 
the same basis. A key bit is hence obtained whenever 
the index of the state sent by Alice is different from the 
index measured by Bob. Notice that this encoding and 
decoding works without having to apply any constraint 
to the basis states of e and /. Bob obtains a I, if he 
measures an e state and he obtains a 0, if he measures /, 
whenever a key bit is transmitted, i.e. when Alice's and 
Bob's indices are different. 

Suppose the secure key distribution between Alice and 
Bob is challenged by an eavesdropper Evan. As in 
Ref. [S], we assume in the following that Evan applies 
an intercept-resend strategy in order to obtain the in- 
formation transmitted from Alice to Bob. This means, 
Evan measures the state of each incoming photon in a 
basis g, 
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{\gk) ■.k = l,2} 



(2) 



KMB09 protocol in Section III 



which is optimal for his purpose of minimising the error 
rate introduced into the key bit transmission. Later on 
Evan forwards the photon, in the state he found it in, to 
Bob. 



A. The basic protocol 

In the case of two-dimensional photon states, the 
KMB09 protocol suggests that Alice and Bob use two 
bases e and / of the form 

e = {|e,) :^ = l,2} , 

/ EE = 1,2} . (1) 

Alice randomly prepares photons in the basis states of 
e and / and sends them afterwards to Bob. For each 
incoming photon. Bob randomly selects a basis and mea- 
sures its state either in e or in /. After the transmission 
of many photons, Alice publicly announces the index i 
of each prepared state. Bob compares these indices with 
the indices of his measurement outcomes and interprets 
his findings as suggested by Table |lj For each measured 
photon, he obtains either 0, 1, or x. These results in- 
dicate respectively whether a 0, a 1 or no bit has been 



B. Parametrisation of states 

Restricting ourselves to two-dimensional photon states 
allows us to represent the basis states of e, /, and g with 
the help of a Bloch sphere [12]. The Bloch sphere rep- 
resentation allows to visualise two-dimensional complex 
vectors by writing them as three-dimensional real vectors. 
This is possible after neglecting an overall phase factor 
with no physical consequences. Taking this into account, 
any quantum mechanical state vector can be expressed as 
a function of two angles 9 and (j) which serve as the spatial 
coordinates for the corresponding three-dimensional real 
vectors of unit length. In the following we use this ap- 
proach to obtain a relatively simple parametrisation for 
all the possible basis states which can be used by Alice, 
Bob, and Evan. 

Without restrictions we assume in the following that 
the basis states of e are the canonical basis vectors. 
Choosing an appropriate coordinate system, the vectors 
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of the / basis can then be written such that they relate 
to the states of e via a simple rotation by an angle 9i . In 
this coordinate system, the generation of the basis states 
of g requires in general two rotations of the e basis: one 
rotation by an angle 9^ and another rotation by an angle 
03. More concretely, we assume in the following that 
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where 0i, 0^, and 03 are real numbers ranging from to 
27r. These three parameters describe all possible sets of 
bases e, /, and g. When looking for an optimal strat- 
egy, Alice and Bob only need to consider all the possible 
values of these three angles. 

Since all the states of the bases e, /, and g are of unit 
length and pairwise orthogonal, one can easily check that 
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This means, for example, that 

l(5i|e2)P = l-|(ffi|ei)P = l-|(<?2|e2)P (5) 
which implies 

|(5i|ei)P = |(52|e2)r (6) 

An analog relation applies between the states of the g 
and of the / basis. 

C. Index transmission errors 

Let us first examine the error in the transmission of 
each state's index. An index transmission error occurs 
when a photon prepared in je^) (or \fi)) is measured at 
Bob's end as \ej) (or \fj) respectively) with i ^ j. As- 
suming that Alice randomly prepares all the states of e 
and / with the same frequency and that Bob measures 
e and / with the same frequency, we find that the Index 
Transmission Error Rate (ITER) of the KMB09 protocol 
equals [S] 
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Using Eqs. Q and ([6|, this expression simplifies to 
Piter - KsiMl' + |(gi|/i>|' - |(5i|ei>|'^ 



(7) 



(8) 



This expression can be calculated relatively easily for all 
possible bases e, /, and g, i.e. for all possible values of 
6*1, 6*3, and ^3. 



D. Quantum bit errors 

In addition to calculating the transmission error rate 
in terms of the index, Alice and Bob can calculate the 
transmission error rate in terms of the quantum bit. The 
Quantum Bit Error Rate (QBER) is calculated by select- 
ing a certain number of control bits from the obtained key 
sequence and comparing them openly. For the KMB09 
protocol with two-dimensional photon states, the proba- 
bility Pqber for getting a wrong bit equals [S] 
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(9) 



Using again Eqs. Q and (|6]), the above equation simpli- 
fies to 

-Pqber = 

\{ei\9i)\' + \{fi\9i)\'~\{ei\9i)\'-\{fi\9i)\' 
2(l(ei|ffi)P + - (l(ei|.9i)P + |(/i|gi)P)^ ' 

(10) 

Using the concrete vectors in Eq. ^ we can now calculate 
the QBER for all possible scenarios. 



E. Efficiency with and without eavesdropping 

In the KMB09 protocol, Alice and Bob successfully 
obtain a key bit when both use different bases and when 
the index of the state measured by Bob is different from 
the index of Alice's state. The rate of transmitted key 
bits per transmitted photon hence equals [S] 



(11) 



= 1 37^1 



in the absence of any eavesdropping. This equation takes 
into account that Alice chooses randomly between 4 dif- 
ferent states and that there is a probability of | for Bob 
to select one of the two bases e and /. Under ideal condi- 
tions, no key bit is obtained whenever Alice and Bob use 
the same bases. Renaming some of the indices and using 
again the relations in Eqs. Q and Q, Eq. ( 11 ) simplifies 
to 



V = ^-^l(ei|/i)p. 



(12) 



For the concrete basis vectors in Eq. ([s]), we hence find 
1 . 



(13) 



For completeness, we also calculate the bit transmission 
rate ?7Evan in the case of an intercept-resend eavesdrop- 
ping attack. This efficiency equals the probability that 



4 



the index j of Bob's state is different from the index i of 
the state send by Ahce which is given by [8j 

2 2 

i—1 k — 1 jyi^i 

M{M9k)\'^{9k\m' + \{M9k)\'.\{9k\e,}\' 



+ \{e^\9k)\'.\{9k\m' 



(14) 



Using again Eqs. Q and ([6| one can show that this equa- 
tion is equivalent to 



For example, for 0i = 54°, we observe that minimising 
the QBER yields Piter = 0.4 and rysvan = 0.5. Minimis- 
ing the ITER is possible but not without increasing the 
QBER further. However, for relatively large QBER's, 
Evan has in general quite a lot of flexibility to choose his 
measurement basis g such that the ITER, the QBER, 
and jyEvan assume certain values by carefully adjusting 
^3 and In other words, Evan is able to make eaves- 
dropping errors look like system errors when it matters 
most. To overcome this problem, we now have a look at 
a variation of the KMB09 protocol. 
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cMl' + lifMf ■ (15) 
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Renaming indices and using again Eqs. Q and (|6| finally 
yields 



^Evan = l(ei|5l>l' + l(./l|5l>l' 

^ 'l(ei|gi>P + |(/i|5i)l' 



(16) 



This bit transmission rate is in general much higher than 
the efficiency t] in Eq. (13). 



F. Interplay between the ITER and the QBER 

As mentioned in Section [ij one feature of KMB09 is 
that an eavesdropper introduces not only one but two 
different types of errors into the key bit transmission. 
The relationship between the QBER, the ITER and the 
key bit transmission efficiency JjEvan can be used by Alice 
and Bob to detect eavesdropping much more efhciently. 
Evan only remains unnoticed, if these variables change, 
as if their changes were caused by system errors and not 
by eavesdropping. When there are very strong corre- 
lations between error rates and efRciencies, finding an 
eavesdropping strategy which fulfills this condition be- 
comes a very hard, maybe even an impossible task for 
Evan to complete. 

We therefore now have a closer look at the relation 
between error rates and key bit transmission efficiencies 
for KMB09. In the following we consider three different 
choices of Alice and Bob's angle 9i and assume that 9i 
equals either 54°, 71°, or 90°. Moreover, we consider all 
possible choices of Evan's measurement basis g by varying 
both angles 63 and 03 in Eq. ([3| between and 27r. For 
each case, we calculate the QBER, the ITER, and the bit 
transmission efRciencies rj and jyEvan- As illustrated in 
Fig. [1] the QBER in case of eavesdropping is in all three 
cases relatively high. It equals 40%, 33%, and 25%, 
respectively. We also see that 77 is relatively high in all 
three cases. It equals 12%, 17%, and 25%, respectively. 

Moreover we notice that Evan has only limited free- 
dom to choose certain values for the QBER, the ITER, 
and the key bit transmission efficiency ryEvam as long as 
the QBER is relatively close to its theoretical minimum. 
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FIG. 1: The ITER, rj and r^Evan as a function of the cor- 
responding quantum bit error rate for (a) 9i = 54°, (b) 
6*1 = 71°, and (c) 81 = 90° for all possible choices of Evan's 
measurement basis. This means, the above figures are the 
result of a numerical simulation which varies both angles 6s 
and (^3 between and 2-k. 
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III. A VARIATION OF THE KMB09 
PROTOCOL 

There are many possible generalisations of the above 
described protocol (cf. eg. Refs. ^ and [10] )• In the 
following, we present a variation which replaces the two 
bases e and / of Alice and Bob by three bases e, /, and 
h. Again we restrict ourselves to two-dimensional photon 
states. As we shall see below, the proposed variation of 
KMB09 yields QKD protocols with strong correlations 
between the ITER and the QBER. This means, errors 
caused by intercept-resend eavesdropping have a distinct 
signature. 



A. Basic premise 

In the following we denote the bases used by Alice and 
Bob e, /, and h such that 
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(17) 

Suppose these bases encode 0='OO', 1='01', and 2='10', 
respectively. Proceeding as above and using a table simi- 
lar to Table |Tj Bob can then no longer decode Alice's key 
bits even when both obtain states with a different index. 
Suppose Alice sends a photon in \ei) and Bob measures 
\hj) with i j. Then Bob knows that the incoming pho- 
ton has not been prepared in the h basis but he still does 
not know whether Alice sends a or a 1. 

A solution to this problem which does not result in a 
significant drop of the key bit transmission efficiency is 
that Alice and Bob form three pairs by pairing each basis 
with every other basis. In the following we denote these 
sets by Si, 5*2, and S3 and define 



Si = {e, /} , S2 = {e,h} 



{/>} 



(18) 



Suppose Alice sends a photon prepared in je^) which is 
measured by Bob in | hj ) with i ^ j. Bob now randomly 
chooses one set which includes his measurement basis and 
announces it publicly. If he announces for example iS'2, 
then Alice knows Bob's measurement basis which allows 
them to obtain a shared-secret key. If Bob announces 6*3, 
then Alice does not know Bob's measurement basis. In 
this case, Alice and Bob cannot deduce a key bit although 
both of their states have a different index. 
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TABLE II: Meaning of Alice's basis in which she prepares the 
photon depending on which set has been announced by Bob. 



TABLE III: Interpretation of Bob's measurement outcomes 
for the case, where the indices of Alice and Bob's states are 
different and where both their bases are included in the set 
announced by Bob. Evan cannot guess which bit is transmit- 
ted, since each set is equally likely to encode a or a 1. 



In order to avoid that Evan can guess key bits with a 
probability that is higher than the probability for correct 
random guessing, Alice and Bob should employ the anal- 
ogy of their situation to the KMB09 protocol and restrict 
themselves to a two letter alphabet. They should use a 
different encoding of the transmitted key bit, depending 
on which set of basis pairs has been announced by Bob. 
One possible encoding is shown in Table |llj here / en- 
codes either a or a 1, while e always encodes 0, and 
h always encodes 1. Most importantly, each set of bases 
Sk is equally likely to encode a and to encode a 1. In 
this way, the eavesdropper obtains no information when 
Bob announces his chosen set. How this new encoding 
affects Bob's interpretation of his measurement outcomes 
is explained in Table [TTTl 

Before stating the concrete protocol let us summarise 
the three types of classical information which Alice and 
Bob have to reveal with every successful photon trans- 
mission: 

a Firstly, Alice must announce the index of each 
transmitted state after sending the photon to Bob. 

b Secondly, Bob must announce a set Sk, whenever 
Bob's measurement index is different from Alice's 
index. 

c Finally, Alice must announce whether Bob's set S^ 
contains her basis or not. 

Bob chooses his set Sk by randomly choosing between 
two bases pairs which contain his measurement basis. A 
key bit is obtained, if the set chosen by Bob contains both 
the basis which the photon has been prepared in and the 
basis which the photon has been measured in. 



B. The proposed protocol 

We now assume that Alice and Bob already agreed on 
a concrete set of bases B = {e, /, h} for the preparation 
and the measurement of their photon states. Moreover, 
we assume that they introduced the basis pairs 5*1, S2, 
and S3 in Eq. ( 18 1 and that they agreed to use the inter- 



pretation of information suggested in Tables |II] and |III| 
Then their QKD protocol works as follows: 
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1. Alice generates a random sequence of symbols x £ 
{e, /, /i} and assigns a random index i e {1,2} to 
every one of them. 

2. Alice then uses this sequence and the correspond- 
ing indices, prepares a sequence of photons in the 
respective states \xi), and sends them to Bob. 

3. Bob measures the state of every incoming photon, 
thereby randomly switching his measurement basis 
among the three bases in B. 

4. Afterwards, Alice announces her random sequence 
of indices i publicly. 

5. Bob announces which photons he found in a state 
lUj) with an index j which is different from the i 
of the corresponding state \xi). For each of these 
photons, he announces a set Sk which contains his 
respective measurement basis. 

6. Alice announces which ones of these sets contain 
the basis in which she prepared the respective pho- 
ton. Now Alice and Bob both know which photons 
transmit one key bit and interpret the correspond- 
ing photon states accordingly. 

7. Finally, Alice and Bob openly compare some quan- 
tum bits and some indices of transmitted states. 
This allows them to calculate their QBER, their 
ITER, and their key bit transmission efficiency. If 
they detect an eavesdropper, the generated crypto- 
graphic key is not secure. 



find that the probability for an index transmission error 
equals 

2 2 

i—l k—1 j^i 

+ l(/d.9fe)n(5.|/,)P + l(/».k-)n(5fc|/^.)P] . (20) 

This equation adds the probabilities of all events which 
might result in the transmission of a wrong index, like the 
case where Alice sends a photon in |ei), Evan measures 
and Bob finally finds the photon forwarded to him 
by Evan in |e2). Using Eq. Q and the fact that the states 
of all the bases are of unit length, Eq. ( 20 ) simplifies to 
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(21) 



As expected, the ITER is one minus the probability that 
no index transmission error occurs, when Alice and Bob 
measure in the same bases. Simplifying the ITER further 
using Eq. Q and analog relations for the / and the h 
basis, wc find that 
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-I(ffi|ei)|'-|(<?i|/i)l'-|(5i|/^i)l' (22) 



which is easier to evaluate than Eq. (21 1. 



Parametrisation of states 



Eq. ([3]) describes a way to parametrize the basis states 
of e, /, and g by three angles 9i, 9^, and 03. Since 
the QKD protocol discussed in this section requires an 
additional basis /i, we moreover define 



(19) 



where 62 and 4)2 are real numbers ranging from to 27r. 



D. Index transmission errors 

An index transmission error occurs when a photon pre- 
pared in a state with index i is measured at Bob's end 
in the same basis but found in a state with an index 
j ^ i. To calculate the corresponding error rate we con- 
sider only the cases, where Alice and Bob use the same 
basis. Taking into account that the probability for choos- 
ing one of the six states available to Alice equals i, we 



E. Quantum bit errors 

The QBER is the ratio of the number of erroneous 
bits to the total number of detected bits. This means, 
to determine their QBER, Alice and Bob need to select 
some of the transmitted bits as test bits and compare 
their values publicly. A closer look at the above protocol 
shows that the QBER is closely related to the ITER. 
The reason is that a quantum bit error occurs whenever 
Alice and Bob obtain a different index, although both 
use the same basis (c.f. Table III). When both use the 



same bases, it does not matter which set Si, S2, or S3 
Bob chooses, since Alice's basis is automatically included 
in his set and a key bit is obtained. Taking this and the 
fact that Alice and Bob both choose the same bases with 
probability 1 into account, we find that 



QBER 



Piter 
3Pqb 



(23) 



where Pqb is the probability of Alice and Bob obtaining 
a key bit for each transmitted photon. 

To calculate Pqb, we notice that whenever Alice and 
Bob use a different basis, there is a probability of ^ that 
Bob chooses a set 5*1, S2, or S3 which does not contain 
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Alice's basis. This means, even when Ahce and Bob mea- 
sure a different basis and obtain a different index, no key 
bit is obtained in half of the cases. To calculate Pqb we 
now sum over all these cases and the cases where Alice 
and Bob contain a wrong bit and find that 
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The factor ^ is the probability of Bob choosing one out 
of the three possible bases e, / and h, while the factor g 
takes into account that Alice prepares her photons ran- 
domly in one of six possible states. 

Renaming indices in some of the terms, we see that 
every term in Eq. ( 24 ) occurs twice. The quantum bit 



transmission probability Pqb hence simplifies to 

2 2 
i—l k—1 j^i 

+ l(e.k)n(g.|/^,)P + |(/i.k)n(5.l/,>P] .(25) 

Using relations like the ones in Eqs. Q and ([6]), one can 
moreover show that this probability can also be written 
as 



l(.9i|ei)P + |(5i|/i)P + l(5ilMP 
|(5i|ei)|^ + |(<?i|/i)|^ + |(5i|/ii)|' 



+ l(ffi|ei)n(5i|/i)P + l(5i|ei)n(.gi|/ii)|^ 



+ \{9i\fM9i\hi)\' 



(26) 



which is easier to calculate than Eq. ( 25 ) 



F. Efficiency witli and witliout eavesdropping 

As in KMB09, the efficiency of the key bit transmission 
depends on whether Evan is present or not. For exam- 
ple, the key bit transmission rate r/Evan is the probability 
of Alice and Bob obtaining a key bit, when Evan listens 
into the conversation between Alice and Bob. This im- 
mediately implies 



??Ev 



(27) 



with Pqb as in Eq. (26). In order to calculate the key 
transmission efficiency rj in the absence of eavesdropping, 
we have to take into account that Alice chooses randomly 
between six states, that there is a probability of ^ for Bob 
to announce a set which contains Alice's basis, and that 



there is a probability of ^ for Bob to select one of the 
three basis e, /, or h. Moreover, we notice again that no 
key bit is obtained whenever Alice and Bob use the same 
bases. As a result, we find that 



1 1 1 

2 ■ 3 ' 6 



EE[i(^«i/^-)i' + i(^«i^^- 



1=1 

+ l(/.|e,)P + mh,)\' + m\e,)f + \{h,\f,)f] . (28) 

Renaming again some of the indices and using again re- 
lations like the ones in Eqs. Q and ([6]), 77 simplifies to 



1 1 r 

3^9 



\{ei\h)\' + \{ei\h,)\' + \{h\h. 



(29) 



Using Eqs. (|3| and (191, this efficiency rj becomes 

1 1 
6 ~ 18 

-|- cos (j)2 sin 9i sin 62] 



[cos 9i + cos O2 + cos 9i_ cos 62 



(30) 



Since this expression is not overly complicated, we add 
it here for convenience. 



G. Interplay between tiie ITER and the QBER 

The main difference between the QKD protocol which 
we discuss in this section and its original version is that 
using three bases gives Alice and Bob more flexibility. 
They can now choose their angles 0i , 62, and 02 such that 
there are very strong correlations between the QBER 
and the ITER in case of intercept-resent eavesdropping. 
Fig. [2] illustrates the interplay between error rates and ef- 
ficiencies for three different choices of the bases e, /, and 
h. Like Fig.jljbefore, this figure is the result of a numeri- 
cal simulation which varies both angles ^3 and (j)y, between 
and 27r. The main difference between Figs, [l] and [2] is 
that there is now a strong dependence of the ITER on 
the QBER. Figs, ^h) and (c) even show a linear depen- 
dence. This means, in these two cases, intercept-resend 
eavesdropping has a distinct signature which makes it 
much harder for an eavesdropper to hide his presence. If 
the system errors of the transmission line do not have the 
same signature, he cannot enter the scene unnoticed by 
simply replacing the transmission line between Alice and 
Bob with a less faulty one. In other words, eavesdropping 
errors can no longer be mimicked by system errors. 



IV. CONCLUSIONS 

This paper proposes a QKD protocol for which eaves- 
dropping introduces not only one but two different types 
of errors into the key bit transmission with a distinct cor- 
relation between both of them. This is possible, since the 
protocol uses an encoding of information which is differ- 
ent from the encoding of information in BB84 2J . Instead 
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FIG. 2: The ITER, rj and 77Evaii as a function of the cor- 
responding quantum bit error rate for (a) 9i — 65° , 62 = 
65°, 02 = 280°, (b) 01 = 90°, 6*2 = 90°, 02 = 90°, and (c) 
di = 110°, 02 = 225°, 02 = 0° for all possible choices of Evan's 
measurement basis. Like Fig. [l] this figure is the result of a 
numerical simulation which varies both angles 63 and (j>3 be- 
tween and 2n. 



of each basis encoding a whole alphabet, all the states 



of the same basis encode the same letter. As a result, 
eavesdropping introduces quantum bit as well as index 
transmission errors. A quantum bit error occurs, when 
Alice and Bob both obtain different key bits. An index 
transmission error occurs when Alice and Bob use the 
same basis but their respective states nevertheless have 
different indices. Intercept-resend eavesdropping results, 
in general, in a significant change of both the Quantum 
Bit Error Rate (QBER) and the Index Transmission Er- 
ror Rate (ITER). 

The main purpose of the proposed QKD protocol is to 
make it much harder for an eavesdropper to conceal his 
presence. The eavesdropper now not only has to min- 
imise different types of errors. The above mentioned 
strong correlations between the ITER and the QBER 
introduce a distinct signature of eavesdropping. This sig- 
nature allows Alice and Bob to detect the origin of their 
errors and to tolerate lower eavesdropping and higher sys- 
tem error rates without compromising their privacy. We 
no longer require that the error rates in case of eaves- 
dropping unavoidably exceed the system error rate, since 
Evan can no longer disguise his presence as system errors. 
As a result, Alice and Bob should be able to communicate 
securely over much longer distances. 

Finally, let us remark that, for concrete practical 
implementations of the proposed QKD scheme, Alice 
and Bob should choose their bases e, /, and h such that 
their system errors (and not the eavesdropping errors) 
have a distinct signature. Changes of this signature 
can then herald Evan's presence, independent of his 
eavesdropping strategy. Evan only remains unnoticed, if 
the error rates and efficiencies which he introduces into 
the key bit transmission are the same as the ones caused 
by errors of the concrete experimental setup. Finding 
an eavesdropping strategy which fulfils this condition is 
in general a very hard task for Evan to complete. Our 
analysis suggests that it might be impossible for Evan 
to satisfy this condition. 
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